case S_INITIAL:
return "S_INITIAL";
+ case S_PRE_START_SKIP:
+ return "S_PRE_START_SKIP";
+
case S_PRE_START:
return "S_PRE_START";
}
INCR_GENERATED;
- ks->state = S_PRE_START;
+ ks->state = skip_initial_send ? S_PRE_START_SKIP : S_PRE_START;
struct gc_arena gc = gc_new();
dmsg(D_TLS_DEBUG, "TLS: Initial Handshake, sid=%s",
}
if (!read_control_auth(buf, tls_session_get_tls_wrap(session, key_id), from,
- session->opt))
+ session->opt, true))
{
goto error;
}
if (op == P_CONTROL_SOFT_RESET_V1 && ks->state >= S_GENERATED_KEYS)
{
if (!read_control_auth(buf, tls_session_get_tls_wrap(session, key_id),
- from, session->opt))
+ from, session->opt, false))
{
goto error;
}
}
else
{
+ bool initial_packet = false;
+ if (ks->state == S_PRE_START_SKIP)
+ {
+ /* When we are coming from the session_skip_to_pre_start
+ * method, we allow this initial packet to setup the
+ * tls-crypt-v2 peer specific key */
+ initial_packet = true;
+ ks->state = S_PRE_START;
+ }
/*
* Remote responding to our key renegotiation request?
*/
}
if (!read_control_auth(buf, tls_session_get_tls_wrap(session, key_id),
- from, session->opt))
+ from, session->opt, initial_packet))
{
+ /* if an initial packet in read_control_auth, we rather
+ * error out than anything else */
+ if (initial_packet)
+ {
+ multi->n_hard_errors++;
+ }
goto error;
}
#define S_INITIAL 1 /**< Initial \c key_state state after
* initialization by \c key_state_init()
* before start of three-way handshake. */
-#define S_PRE_START 2 /**< Waiting for the remote OpenVPN peer
+#define S_PRE_START_SKIP 2 /**< Waiting for the remote OpenVPN peer
* to acknowledge during the initial
* three-way handshake. */
-#define S_START 3 /**< Three-way handshake is complete,
+#define S_PRE_START 3 /**< Waiting for the remote OpenVPN peer
+ * to acknowledge during the initial
+ * three-way handshake. */
+#define S_START 4 /**< Three-way handshake is complete,
* start of key exchange. */
-#define S_SENT_KEY 4 /**< Local OpenVPN process has sent its
+#define S_SENT_KEY 5 /**< Local OpenVPN process has sent its
* part of the key material. */
-#define S_GOT_KEY 5 /**< Local OpenVPN process has received
+#define S_GOT_KEY 6 /**< Local OpenVPN process has received
* the remote's part of the key
* material. */
-#define S_ACTIVE 6 /**< Operational \c key_state state
+#define S_ACTIVE 7 /**< Operational \c key_state state
* immediately after negotiation has
* completed while still within the
* handshake window. Deferred auth and
* client connect can still be pending. */
-#define S_GENERATED_KEYS 7 /**< The data channel keys have been generated
+#define S_GENERATED_KEYS 8 /**< The data channel keys have been generated
* The TLS session is fully authenticated
* when reaching this state. */
read_control_auth(struct buffer *buf,
struct tls_wrap_ctx *ctx,
const struct link_socket_actual *from,
- const struct tls_options *opt)
+ const struct tls_options *opt,
+ bool initial_packet)
{
struct gc_arena gc = gc_new();
bool ret = false;
const uint8_t opcode = *(BPTR(buf)) >> P_OPCODE_SHIFT;
if ((opcode == P_CONTROL_HARD_RESET_CLIENT_V3
|| opcode == P_CONTROL_WKC_V1)
- && !tls_crypt_v2_extract_client_key(buf, ctx, opt))
+ && !tls_crypt_v2_extract_client_key(buf, ctx, opt, initial_packet))
{
msg(D_TLS_ERRORS,
"TLS Error: can not extract tls-crypt-v2 client key from %s",
* into newbuf or just setting newbuf to point to the start of control
* message */
bool status = read_control_auth(&state->newbuf, &state->tls_wrap_tmp,
- from, NULL);
+ from, NULL, true);
if (!status)
{
bool prepend_ack);
-/*
+
+/**
* Read a control channel authentication record.
+ * @param buf buffer that holds the incoming packet
+ * @param ctx control channel security context
+ * @param from incoming link socket address
+ * @param opt tls options struct for the session
+ * @param initial_packet whether this is the initial packet for the connection
+ * @return if the packet was successfully processed
*/
bool
read_control_auth(struct buffer *buf,
struct tls_wrap_ctx *ctx,
const struct link_socket_actual *from,
- const struct tls_options *opt);
+ const struct tls_options *opt,
+ bool initial_packet);
/**
bool
tls_crypt_v2_extract_client_key(struct buffer *buf,
struct tls_wrap_ctx *ctx,
- const struct tls_options *opt)
+ const struct tls_options *opt,
+ bool initial_packet)
{
if (!ctx->tls_crypt_v2_server_key.cipher)
{
return false;
}
+ if (!initial_packet)
+ {
+ /* This might be a harmless resend of the packet but it is better to
+ * just ignore the WKC part than trying to setup tls-crypt keys again.
+ *
+ * A CONTROL_WKC_V1 packets has a normal packet part and an appended
+ * wrapped control key. These are authenticated individually. We already
+ * set up tls-crypt with the wrapped key, so we are ignoring this part
+ * of the message but we return the normal packet part as the normal
+ * part of the message might have been corrupted earlier and discarded
+ * and this is resend. So return the normal part of the packet,
+ * basically transforming the CONTROL_WKC_V1 into a normal CONTROL_V1
+ * packet*/
+ msg(D_TLS_ERRORS, "control channel security already setup ignoring "
+ "wrapped key part of packet.");
+
+ /* Remove client key from buffer so tls-crypt code can unwrap message */
+ ASSERT(buf_inc_len(buf, -(BLEN(&wrapped_client_key))));
+ return true;
+ }
+
ctx->tls_crypt_v2_metadata = alloc_buf(TLS_CRYPT_V2_MAX_METADATA_LEN);
if (!tls_crypt_v2_unwrap_client_key(&ctx->original_wrap_keydata,
&ctx->tls_crypt_v2_metadata,
* message.
* @param ctx tls-wrap context to be initialized with the client key.
*
+ * @param initial_packet whether this is the initial packet of the
+ * connection. Only in these scenarios unwrapping
+ * of a tls-crypt-v2 key is allowed
+ *
* @returns true if a key was successfully extracted.
*/
bool tls_crypt_v2_extract_client_key(struct buffer *buf,
struct tls_wrap_ctx *ctx,
- const struct tls_options *opt);
+ const struct tls_options *opt,
+ bool initial_packet);
/**
* Generate a tls-crypt-v2 server key, and write to file.
.mode = TLS_WRAP_CRYPT,
.tls_crypt_v2_server_key = ctx->server_keys.encrypt,
};
- assert_true(tls_crypt_v2_extract_client_key(&ctx->wkc, &wrap_ctx, NULL));
+ assert_true(tls_crypt_v2_extract_client_key(&ctx->wkc, &wrap_ctx, NULL, true));
tls_wrap_free(&wrap_ctx);
}
projects / thirdparty / openvpn.git / commitdiff
